[
 {
  "value": "9.20.4.14",
  "type": "ipv4",
  "first_seen": "2026-09-09",
  "last_seen": "2026-09-09",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "active-exploitation-of-cisco-secure-firewall-management-center-v"
  ],
  "sources": [
   "https://malware.news/t/cisco-security-advisory-av26-197-update-3/125481#post_1"
  ],
  "reason": "Attacker IP in Cisco FMC exploitation campaign (CVE-2026-20079 / CVE-2026-20316)"
 }
]